Repository navigation
CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7 #471
Description
CVE-2026-56416 - Medium Severity Vulnerability
Vulnerable Libraries - src4.0.4, freebsd-srcrelease/15.0.0-p7
src4.0.4
MidnightBSD OS source code
Library home page: https://github.com/MidnightBSD/src.git
Vulnerable Source Files (1)
freebsd-srcrelease/15.0.0-p7
The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....
Library home page: https://github.com/freebsd/freebsd-src.git
Vulnerable Source Files (1)
Found in base branches: stable/4.0, master
Vulnerability Details
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.
Publish Date: 2026-07-22
URL: CVE-2026-56416
CVSS 3 Score Details (4.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
Step up your Open Source Security Game with Mend here
Activity
[-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/+][-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4 - autoclosed[/+]mend-bolt-for-github commentedon Sep 18, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
mend-bolt-for-github commentedon Sep 18, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
[-]CVE-2026-56416 (Medium) detected in src4.0.4, src4.0.4 - autoclosed[/-][+]CVE-2026-56416 (Medium) detected in src4.0.4, freebsd-srcrelease/15.0.0-p7[/+]mend-bolt-for-github commentedon Oct 7, 2026
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.